Extracted

Extracted

• • Target

    66e8ed7eb5c8cc1135f3d49940933583a8e42d959e1013c23f6cadf17e7d074b

  • Size

    1.0MB

  • MD5

    b7f58db06e6337252ca2b1a37e0552c6

  • SHA1

    49651353b8d40058bfea7ed4be5482f160ed2edf

  • SHA256

    66e8ed7eb5c8cc1135f3d49940933583a8e42d959e1013c23f6cadf17e7d074b

  • SHA512

    7cfcc985f6fed68ce8a8d2f5a65ed08bd46b01c2beea4076b70583f83a54831fbe83f0beebbe0e65c12fc45ba3e084c1676e9fa4a2da3b1722d7058c87df2b27

  • SSDEEP

    24576:3yuSSavBVqBD2ukgDslO0lfQn4yc0w0NC784ls1bUo:CuABVqBD2ukgqYdpO844bU

  Score

  10^/10

  redlinefashlinadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1